To avoid Android pitfalls, Mozilla shoulders Firefox OS update burden

Something like this Mozilla reference phone, built with a processor from Chinese chipmaker Spreadtrum, will hit the market as a $25 device for customers who don't have the funds for higher-end phones.

(Credit: Stephen Shankland/CNET)

BARCELONA, Spain -- Mozilla will take over some responsibility for issuing Firefox OS updates that carriers today have, a move that could help users avoid the fate of Android phone owners saddled with older operating system versions.

"We are pushing that envelope," Chief Technology Officer Brendan Eich told CNET. "We think we can get people on Wi-Fi upgrading through Mozilla."

That would mean a person could step into an Internet cafe then update the software as soon as Mozilla releases a new version or security fix, rather than waiting for a handset maker to build, test, and release the update through a network operator partner.

But, Eich cautioned, "We are not there yet." OS updates are a risky proposition for carriers, which don't want to risk bricked phones and the attendant customer support difficulties.

Part of the change is driven by the fact that carriers aren't necessarily going to be in the loop with Mozilla's $25 Firefox OS smartphone, announced this week at Mobile World Congresshere. For that phone, people often will buy the phone from a bin at a retail store, Eich said, picking a carrier later.

Operating system updates can be a sore point for smartphones. Most Apple customers upgrade operating systems relatively swiftly, but even mid-range Android phones often don't see new versions of the operating system. That leaves customers without new features, makes lives difficult for app developers struggling to support older models, and exposes people to security risks.

Firefox OS is still a young challenger in the marketplace, with the first phones going on sale in July 2013 in Spain, but now it's available in 15 markets, chiefly Eastern Europe and Latin America.Firefox OS risks this problem, too. Although Mozilla issues Firefox OS updates at half the rate it does with Firefox -- every three months instead of every six weeks -- that's still too fast for some. Alcatel skipped the Firefox 1.2 update because of some problems with the 1.1 update.

"In the next several months, we'll add 12 new markets," said Jay Sullivan, Mozilla's acting chief executive officer, at a press conference at the show Sunday. "Later in the year, we'll have a large focus on Africa and Asia."

Popular web browsers face threat of mischievous attacks

The agency, in its advisory, said the vulnerability is caused "due to improper restrict access to 'about:home' buttons by script on other pages in Mozilla Firefox".

NEW DELHI: Multiple vulnerabilities have been detected in popular web browsers Google Chrome and Mozilla Firefox and cybersecurity sleuths have advised internet users in the Indian cyberspace to guard against arbitrary activities on their systems.

In view of these suspicious virus-based activities, internet users have been asked to upgrade their personal versions of these two most used web browsers on their work stations.

"Multiple vulnerabilities have been reported in Mozilla Firefox, Thunderbird and SeaMonkey which could be exploited by a remote attacker to bypass certain security restrictions, disclose potentially sensitive information, gain escalated privileges, execute arbitrary code and causes denial of service condition on the affected system," the Computer Emergency Response Team of India (CERT-IN) said in its latest advisory to online users in the country.

The CERT-In is the nodal agency to combat hacking, phishing and to fortify security-related defences of the Indian internet arena.

"The two web browsers are an important tool for internet surfing among Indian online consumers. The anomalies have been detected recently and it would be advised that users upgrade their existing versions sooner than later. These activities are mischiefs on part of hackers or they are harmful viruses," a cyber security expert told PTI.

The agency, in its advisory, said the vulnerability is caused "due to improper restrict access to 'about:home' buttons by script on other pages in Mozilla Firefox".

"A user-assisted remote attacker could exploit this vulnerability using a crafted website or webpage. Successful exploitation of this vulnerability could allow user-assisted remote attacker to cause a denial of service condition," the CERT-In said.

Chrome, Opera pass Epic Citadel demo's Web graphics test

The Epic

Citadel demo of Unreal Engine 3 running in a browser using high-speed JavaScript and WebGL.
(Credit: screenshot by Stephen Shankland/CNET)

Chrome and Opera have become the first browsers to match Mozilla Firefox's support for Epic Games' Unreal Engine 3 and the Web-based Epic Citadel demo that's built on the 3D graphics technology. The demo's computing challenges include 3D graphics covered with 2D textures, rustling leaves, flowing water, reflective stone floors, lens flare, and shadows and other lighting effects.

Mozilla and Epic Games demonstrated the advanced Web programming in March using a combination of Mozilla technologies: Emscripten that converts C or C++ software into JavaScript, and asm.js that can run a specialized subset of JavaScript much faster.

Mozilla has been trying to drum up support for asm.js, but Chrome and Opera used their own JavaScript technology. (Opera Software, earlier this year, shifted away from its browser engine, adopting Chrome's and benefiting from Google's investment in the software.) The Epic Games demo also uses the WebGL standard for 3D graphics, which Chrome, Mozilla, and Opera all support.

The new browser support is notable, given the push toward Web programs that run on any machine with a browser -- cross-platform flexibility that has big advantages over writing native code that only works on iOS, Windows, or some other specific operating system. But the maturity and consistency of Web programming still leave a lot to be desired, especially for complicated, performance-intensive Web apps.Epic Games added Chrome 31 and Opera 18 to its Unreal Engine 3 supported browsers list. Martin Best, the product manager of games at Mozilla, noted the rival browsers' achievementin a blog post Tuesday.

Mozilla and Google got their Unreal performance with significantly different approaches. Asm.js uses a technology called ahead-of-time (AOT) compilation for its performance boost, with the Web app sending a "use asm" hint to the browser to trigger the technology. Compilation is the process of converting human-written source code into machine language that a computer can execute. AOT compilation means the browser can build an optimized version of the software in advance.

The Epic Citadel demo of Unreal Engine 3 running in a browser using high-speed JavaScript and WebGL.

(Credit: screenshot by Stephen Shankland/CNET)

But Chrome uses a different approach with its V8 JavaScript engine called just-in-time (JIT) compilation that's standard nowadays for most Web sites and Web apps. The JIT approach means the browser compiles the JavaScript, monitors how it runs, and optimizes with new compilation as it goes.

"V8 people seem to want to JIT-optimize harder, not process 'use asm,'" said Mozilla Chief Technology Officer Brendan Eich, but he's not convinced the performance will catch up to AOT compilation. In his experience, Unreal Engine 3 on Chrome shows more "jank" from pauses triggered by recompilation.

"Yet they do well," Eich said, praising Chrome's virtual machine that runs the JavaScript programs. "V8 is a formidable JIT'ing virtual machine."

In my tests of the two, Chrome showed a higher frame rate on a 2012 Retina-equippedMacBook Pro. Firefox Nightly version 28.0a1 (2013-11-26) showed 52.4fps, but Chrome 33.0.1712.4-dev ran at 59.8fps.

Both versions sent the CPU fan whirring, though, so there's still work to be done.

The Epic Citadel demo of Unreal Engine 3 running in a browser using high-speed JavaScript and WebGL.

(Credit: screenshot by Stephen Shankland/CNET)